Extracted

• • Target

    7cfcf1f761f24cbf1a2e45d4f2b66a37ae00e69b83af6090e9b2d2caaf508913.exe

  • Size

    1.1MB

  • MD5

    badc83aedf89f8fe1b3d2671d4d6ce9e

  • SHA1

    19bcc0edc7632642371bfed76416766bacf8d3be

  • SHA256

    7cfcf1f761f24cbf1a2e45d4f2b66a37ae00e69b83af6090e9b2d2caaf508913

  • SHA512

    4dba47640df022ac0ed9ffaa14842758f9c68f020e131202fd81963e0743cf00a15605623f2ac8ee9ed3af062b5d1d9a949898063164050f8302457b5fc7729f

  • SSDEEP

    24576:NecME1UkUQSJTMP+kYMZ5Xu6uWYiua+c5Iv28x71MEaLmm4Y:NecMEukUKYMvbu6u2hLx

  Score

  10^/10

  danabot5aspackv2bankerdiscoverytrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Blocklisted process makes network request

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2